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Abstract 

I present an implementation in the Coq proof assistant of type- 
directed partial evaluation algorithms for call-by-name and call-by- 
value versions of simply typed lambda calculus with delimited con- 
trol operators shift and reset (level- 1 in the shift/reset hierarchy), 
and in presence of strong sum types. The typing system does not 
support function types with answer-type modification and allows 
reset to be set on at most one atomic type. 

I also argue that using as implementation language one sup- 
porting full/strong reduction, versus weak-head reduction, as most 
functional languages do, one does not have to resort to techniques 
such as wrap-stacks or let-insertion when writing a partial evaluator 
for a call-by-value source language. 
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1. Introduction 

Type-directed partial evaluation (TDPE) is a technique that par- 
tially evaluates a program by first compiling it, and pre-computing 
known ("static") input data on the fly, and then decompiling it to 
normal form in an efficient process driven by the program's type. 
It was discovered by Danvy 1 8] in Programming Languages theory, 
but the exact same algorithm has been isolated at about the same 
time also in the study of typed lambda calculi and in Logic: Berger 
and Schwichtenberg 1 6] found it while looking for an efficient pro- 
cedure for reducing open lambda terms and called it Normalization 
by evaluation (NBE); Catarina Coquand |7] realized that it is the 
procedure behind the proof of completeness of minimal intuition- 
istic logic (without V and 3) with respect to Kripke models. 

However, when one moves from simply typed lambda calculus 
towards more realistic programming languages, the extensibility of 
the TDPE method to cope with the new constructs is not obvious. 
Already adding strong sum types requires one to implement TDPE 
using delimited control operators - indeed, this was one of the 
orig inal applications of Danvy and Filinski's operators shift/reset 

m 

In turn, when considering delimited control operators them- 
selves, Asai 0, 0] has studied them in the context of traditional 
online and offline partial evaluation, and Tsushima and Asai 1 25] 
have shown a type-directed partial evaluator that reduces some im- 
portant examples according to expectations, but whose correctness 
remains to be established. At least for the call-by-name case, this 
correctness might turn out not to be easy to establish, since the call- 
by-name equational theory itself [22] is not as well studied as the 
call-by- value one |21]. 

Motivated by the recently discovered importance of delimited 
control operators in Logic ll4l[Tl.lT7l lT9ll . I developed in Coq a 
normalization proof for the (core of) the logical system from llTH . 



following the NBE method, that also happens to be a TDPE for 
simply typed lambda calculus with sum types and shift/reset (the 
first level of the shift/reset-hierarchy), when the delimited control 
operators obey a typing discipline that: 

1. does not allow answer type modification for functions, as the 
most general typing systems for shift/reset do f5] ; 

2. allows a reset to be set only at a fixed atomic type, and at most 
one such type in a given lambda term, although an arbitrary 
number of resets (and shifts) can be used. 

As shown in flTll , even such a restriction is useful in Logic, since 
one gets to prove the Double-negation Shift principle, unprovable 
in intuitionistic logic, in a constructive logic that includes delimited 
control operators. Whether the restriction is usable in programming 
is a fair question, but in any case we consider this work a work- 
in-progress towards developing TDPE for the full hierarchy of 
shift/reset where resets at different levels can be assigned different 
types. 

This paper is organized as follows. We give the skeleton of 
the TDPE algorithm, implementecQ in the Coq proof assistant as 
our functional language, both for the call-by-name and the call-by- 
value version of the calculi, and consider some comparative exam- 
ples, in Section [S] But, first, we describe a type theoretic model 
which is used as the target of compilation and source of decom- 
pilation, explaining in what sense does it show the correctness of 
the algorithm (Section^. Finally, in Section|4l we mention future 
work and discuss in some detail the related works. 

2. Type-theoretic model 

The programming language that we want to partially evaluate, our 
object language, will be the lambda calculus with function and sum 
types and the shift/reset delimited control operators, described in 
Tabled 

For expressing binders, we avoid using names, and rely on an 
explicit binder handling (hyp and wkn(-)) akin to deBruijn indices. 
Fresh-name generation is simply not the problem that we are trying 
to address here, and that is why lambda abstraction, lam(-), and 
shift, shift(-), are unary. 

The turnstile h can be annotated by a boolean b, of value or 1, 
1 meaning that a reset () has been previousle applied in the lambda 
term. The non-delimited-control rules ignore this annotation b, 
reset() sets it, unless it is already set, and shift() can only be used 
if the annotation has been previousle set to 1 . 

The general idea behind NBE, or TDPE, is the following: we 
want to transform a program written in the object language to a 
meta-level "bytecode" version of it, and then, based on the pro- 
gram's type, recover a program in the object language that is in 
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hyp ■.A,rhtA 



wkn(p) : B,r\-t A 



and a relation 



X : K ^ Bool — > Formula — > Type 



inl(p) ; r hfc ^ V B inr(p) : T hb ^ V B 

piThhAvB g:A,ri-hC r : B, T C 
case(p, g, r) : r hi, C 

p:A,ri-i,B pin-tA^B q:r\-t A 

lam(p) : r hfc ^ -> B app(p,g) : T K B 

p : r hi ± p : ^ ±,r hi ± 

reset(p) : T hb ± shift(p) : T hi A 

where S denotes a fixed type 

Table 1. A typing system for lambda calculus with sum types and 
shift and reset, where variable binding is handled using deBruijn 
indices (hyp and wkn(-)) 

some sense equal to the starting one. This resulting program should 
be in normal form, meaning that applying the TDPE on it once 
more should produce no effect. 

Now, considering delimited control operators shift and reset, 
the orthodox way of interpreting them is by the CPS translaton 
full . Therefore, we would like to build a TDPE that uses the CPS 
language as bytecode i.e. that it is a transformation of the following 
type. 

Syntax — )■ ((Value — > Answer) Answer) — s- Syntax, 

where Syntax denotes the type of programs of the object language, 
and Value and Answer are continuation "values" and "answers" 
in the usual terminology |8]. Also, it would be nice if the types 
were more informative, so that we know more than merelly that a 
program is transformed to another program. We would at least like 
to require that the input and output programs be of the same type, 

Syntax(r,A) — > 

((Value(r,yl) Answer(r, A)) Answer(r, yl)) — > 

Syntax(r,yl). 

In the notation that we introduce shorty, the above statement will 
acquire the form, 

r h A — >r\\- A — ^ r h'' A, 

where F Ih yl denotes the semantical domain that is the target of 
compilation (Subsection l2.lt . and source of decompilation (Sub- 
section |2^ . 

2.1 Evaluating into the models 

The abstract domain is a variant of Kripke-CPS models, which 
have been used, with Herbelin and Lee, for proving NBE for the 
classical sequent calculus LK,iji |20] and NBE for intuitionistic 
natural deduction with disjunction 11811 . 

Definition. A Kripke CPS structure is given by a type K, a relation 
<: K ^ K ^ Type that is a preorder, 

w < w (reflexivity) 

wi < W2 ^ W2 < W3 ^ Wi < wa (transitivity), 



with the properties: 

wi < W2 — >■ XwibA — >■ Xw2bA (< -monotonicity) 
6i C 62 — XwbiA Xb2A ([I -monotonicity) 
Xwll. XwOl. (meta-reset()). 

Bool is the type of booleans with inhabitants (false) and 1 
(true), and C is the orber on booleans determined by the less-than- 
or-equal of their numerical values. Formula is the type of types of 
the object language i.e. those built from — >, V, atomic types, and the 
special fixed type ± that reset can be set on - _L does not necessarily 
denote the empty type, it is simply a convenient notation. 

Inhabitants w of type K are called worlds, and when we have 
XwbA we say that the world w is expoding for the formula A with 
annotation b. 

Definition. Given an F : — 5- Bool —5- Formula — >• Type, A : 
Formula, 6 : Bool, w : K, the dependently typed continuations 
monad, w Ihb A, defined by 

w Iho A :— {C : Formula)(wi : K){w < wi — 

{wi <W2-f FW2QA XW2QC) -f XwiQC) 



w Ihi A :— (wi : K){w < wi —> 

(wi <W2-^ FW2QA Xw2Q^ XwiQl.) 

is called /orc7';3^. That is, we read it; Ihf, yl as "the world w forces 
the type A with annotation 6". 

The F from the previous definition is instantiated using one of 
the two alternatives below. 

Definition (Strong forcing, call-by- value variant). The strong forc- 
ing relation w\[-\ Ai& defined by: 

w Ihj, A := XwbA [A — atomic type) 
w Ihb -L := Xwbl. 
w Ihfc Aw B — wW-l A + w Ihb B 
w H A^ B ■- {w' : K){w <w' ^w\V-lA~^w Ihb B) 

Definition (Strong forcing, call-by-name variant). The strong forc- 
ing relation w Ih^ A is defined by: 

w Ihft A := XwbA [A — atomic type) 

w Ihb -L := Xwbl. 
w Ihfc Ay B --wW-t A + wht B 
w Ihfc A^ B ■- {w' : K)(w < w' w \\-b A ^ w Ihb B) 

Thus, a different strong forcing relation (— Ih'L — ) determines 
a different forcing relation (— lh_ — ), but the properties regarding 
and using this later are the same in both cases, even if the proofs of 
the properties are slightly different. 



Lemma. The following properties hold of strong and ordinary 
forcing: 

w < w' ^ w \\-], A - 
w < w' w A - 

6 C &' ^ TO IK A - 

6 C &' -j. TO 11-6 A - 

w 11-6 ± — )■ Xwhl. 

TO 11-6 A TO 11-6 A 

(to' : K){w <w' ~^w' 11-6 A 

TO 11-6 ^ ^ TO 11-6 B {bind{-,-)) 



to' Ih'^ A 

to' Ihi A 

TO ih-;;, A 

TO 11-6' A 



> to' Ihb B) 

TO 11-6 B 



(run{-)) 
[return^-)) 



Proof. The proofs of these facts are not difficult, and are available 
in the Coq formalization. □ 

We will abuse the syntax to denote forcing and strong forcing 
of lists of formulas, F, defined by, 

TO 11-6 nil ~ nil 
TO 11-6 cons {A, T)~Axw 11-6 T 

TO 1^6 nil nil 
TO 11-6 cons {A, V)~Axw T, 

where x is the product type. Naturally, the monotonicity properties 
from the previous lemma extend to (strong) forcing for lists. 

Theorem (Evaluation/Soundness in call-by-vame). Ifp : F 1-6 A, 
then for any to and any h' such that b \— b' we have that w IhJ,, F 
implies to Ih6' A. 

Theorem (Evaluation/Soundness in call-by-name). Ifp : F A, 

then for any to and any b' such that b ^ b' we have that w ll-6' F 
implies to Ih6' A. 

Proof. The proofs of both theorems are done in continuation- 
passing style, by using induction on the derivation of p. The pro- 
gram skeletons that corresponds to the proofs can be seen in Sec- 
tion[3l □ 

2.2 Reifying from the models 

While the evaluation theorems from the previous subsection can 
be used for any concrete structure that implements the Kripke-CPS 
models axiomatization, in this section we build one such model, 
U, the universal model, which gets its name from the fact that if 
something is forced in U then it is also forced in any other such 
modeQ- 

To obtain a property of the TDPE, we will separate the lambda 
terms into a level of normal terms and a level of neutral terms: 



I ni 



lam(r) | inl(r) | inr(r) | shift(r-) 



e ::= app(e,r) | case(e, ri, r2) | reset(e) | hyp | wkn(r-) 

Definition (The model U). The universal Kripke-CPS model U is 
built when we set 



and 



XwbA 
Xwb± 
Xwb{A V B) 
Xwb{A -> B) 



K := List (Formula) 

[A — atomic type) 



^w\^lA 

= TO hfc ± 
.nf 



TO h" yl V B 

-6^^B. 



The pre-order < is defined as the prefix relation on lists. 

Theorem (Reify/Reflect). Given A : Formula, F : List (Formula) 
arui b ; Bool, the following two statements hold: 

VUA^V h"{ A "reify" ^ii (■)) 

WIA^V Ihfc A "reflect" (^tf (•)) 



Proof. The two statements are proved simultaneously, by induction 
on the type A. The program skeleton corresponding to the proof 
can be seen in Section[3] □ 

Let reflect(F, b) denote the type obtained by applying the fold- 
left function on the list F and the reflection function. For example, 
for F := cons {A, cons [B, cons (C, nil))), we have 

reflect(F,6) = Yb (hyp) x (hyp) x ^t? (hyp) x Unit, 

where Unit is the unit type. 

Now, by composing the Evaluation theorem and the Reifica- 
tion/Reflection theorem, we can obtain TDPE as a corollary. 

Corollary (TDPE for call-by-name). Given p : V ^t, A, we have 



that ^4-6 



\reftect{T,b)) 



F K A. 



Corollary (TDPE for call-by-value). Given p : nil 1-6 A, we have 
that'-%i (Munit) inilKA 

Remark. Note that TDPE for call-by-value can only be used to 
normalize closed terms, while the one for call-by-name can also 
normalize open terms. 

The following property shows that the calculus from Table [T] 
can be considered a constructive logical system, despite the fact 
that it contains control operators which are usually connected with 
classical logic. (Classical logic does not have this property) 

Proposition (Disjunction property). Ifp : nil ho A V B then from 
p one can get p' such that either p' : nil ho A or p' : nil ho B. 

Proof. We can use TDPE to transform p to a term in normal form 
r : F h'' yl V B. Now, from the syntax of normal and neutral forms, 
one can see that the only possibilities for r are that it is either a 
inl(r'), a inr(r'), or one of the two preceeded by a finite number of 
w/kn(()-) terms: r can not be any of the other neutral forms because 
it does not have a free variable, and it cannot be a shift(-) because 
of the annotation on the turnstile. □ 

3. Algorithm 

In this section we show the skeletons of the algorithms that can 
be extracted from the Coq formalization. One can extract complete 
Ocaml programs from it as well, but I think that on paper it is more 
instructive to look at just a part of the structure of the algorithm. 

We will use a two-level lambda calculus: on one level we will 
have the "dynamic" lambda terms from Table [T] and on another 
we will use ordinary mathematical function notation: "h->-" for 
abstraction, "■" for application, ti for injection-left, t2 for injection- 
right, and the usual big-open-curly-bracket for definition by cases. 
The equality symbol ":=" denotes definitional equality. 

The evaluation and reification/reflection algorithms can be see 
on the figures [T] [21 [H and|4] I have marked with boxes the places 
where call-by-value reification and reflection differs from the call- 
by-name one. 



^ We do not prove this fact since it is not relevant here 



|p : r hi, y4|„iK,r -.wW-bA 

Ihyplp := fst(p) 

[wkn(p)]p := Iplsnd{p) 

|lam(p)]p := retum(Q: M> |[p]a,p) 

[app(p,g)lp — bmd((?!) n- • Iqjp, Ipjp) 

|inl(p)]lp — return(ti|p|p) 

|[inr(p)Ip — retum(z,2lplp) 

Ishift(p)]lp — K H. run(|lp]lre,urn(t»i^retum(c,.,^)),p) 

|reset(p)]lp"-^ := retum(run(|plp)) 
|reset(p)]]p^" := return(meta-reset(run(|p|p))) 



Figure 1. Evaluation for call-by-name 

Ip : r 1-6 Al^iK^^r ■■■w\\-bA 

|hyp|p := retum(fst(p)) 
|[wkn(p)|p := Iplsnd(p) 
|lam(p)|p := retum(a ^ Mcp) 
Iapp(p, q)jp ■- bind((j!> h-> bind((j!>, Mp), |p|p) 
|inl(p)|p — bind(a H- return(tia), |[p]p) 
|[inr(p)|p := bind(a M- return(t2Q), IpIp) 
|shift(p)lp :=«:H^run(|pl 
|reset(p)]p=^ := return(run(|p|p)) 
[reset (p)]p^'' := return(meta-reset(run(|pjp))) 



Figure 2. Evaluation for call-by-value 



The programs are written in continuation-passing style, using 
usual monadic operations that were proved in Lemma of Subsec- 
tion [2T| We do not claim that the monadic operations satisy the 
functional programming monad laws, we just use them to structure 
the computation. 

It is important to note that implementing a TDPE in CPS in a 
programming language with full/strong reduction, like Coq, pro- 
vides an advantage. Implementation in conventional languages 
based on weak-head reduction, like ML, make the implementa- 
tion more complicated, even when the object language does not 
have shift and reset ~ compare with the implementation of TDPE 
in CPS for CBV from |25] and 1 12] that uses a wrap-stack. 

As regards the similarity with the previous work on TDPE for 
shift/reset |25J, the main points are: 

1. The TDPE from |2^ , works at more general function types that 
allow answer-type modification. 

2. At function-type-reification time, the TDPE from (2^ con- 
structs a shift(-) immediatelly after the first lam(-), whereas we 
postpone the construction of shift(-) for as long as possible. 

3. We consider both call-by-name and call-by-value. 
3.1 Equational tiieories 

Before considering some examples, we recall the available equa- 
tional theories for shift/reset. They are expressed using the class of 



values, 

V ::= X I Xx.p, 

and a class of pure evaluation contexts, 

F :■- []\Fp \ VF. 

Pure evaluation contexts are the evalution contexts that do not 
contain a reset. 

The equational theory for CBV shift/reset, for the full hierar- 
chy, has been proven sound and complete with respect to its CPS 
translation by Kameyama I2TI1 . Considering only the first level of 



the hierarchy, he gives the following equations: 

{\x.p)V = p{V/x} (1) 

Xx.Vx = V (2) 

{\x.F[x\)p = F[p\ (3) 

{V) = V (4) 

{{\x.p){q)) = {\x.{p)){q) (5) 

Sk.{p)=Sk.p (6) 

Sk.k{p) = (p) (7) 

Sk.kp = p (8) 

{F[Sk.p\) = {p{{\x.{F[x])) I fc}) (9) 



4-6 



rihi,yl- 



r h"^ A 



^io" (a) := run(Q) 
^4" (q) := shift(a ■ (x 
ib (q) := lam( |b (k i 



4-0 (a) 



7 I— > 



'"4-'i^^ (a) := shift(a • 



^ app(hyp,x))) 

^ ■"■'if (hyp) . (a' ^ a . (0 

inlfi^(/3)) ,if7 = M/3 
inr(r;f(/3)) , if 7 = ^2/3 

app(hyp,inlf4.'? (/?))) 
app(hyp,inr(a? (/?))) 



■ (retum(af')) ■ «:)) 



if 7 = ti/3 
if 7 = t2/3 



when Ao is atomic 
when Ao is atomic 



(■) : r h"U ^ r iht A 

^tf « (e) := retum(e) 
't^-^'' (e) := retum(a ^ ^ (app(e,^4 («)))) 

'"tb^^ (e) := «: case(e, '^''"'[^ (hyp) ■ (a «: • tiretum(Q)), ^''"tb (hyp) ■ (a i— >■ k • t2retum(a))) 



when Ao is atomic 



Figure 3. Reification and reflection for cafl-by-name 



\i (•) : r ihb A r h"U 

X' («) 
(«) 



■ run(a) 

: shift(a ■ (x iH> app(hyp,x))) 

^4-6"""^ (a) := lam(^4,f (k "'^'^tt (hyp) ■ (a' a ■ (0 i-^ ■ ( 



^4° 



io (a) 



(a) := shift(Q . 



inl(a^ ( retum(/3) |) ) 
inr(r4.f (I return(/3) )) 



if 7 = ti/? 
if 7 = t2/? 



app(hyp,inl(r4,f ( return(/?) |) )) 
app(hyp, inr(r;f (I return(/3) ))) 



AC)) 




when Ao is atomic 
when Ao is atomic 



^tf (•) : r h^'^ A ^ r ihb A 

^t^» (e) := return(e) 



(app(e,^4,f ( retum(Q:) )))) 



'"tb"*^ (e) := return(Q n> 
"if (e) := K case(e, "^'^tb (hyp) ■ (q k ■ ti[a]), ^'^tf (hyp) ■ (av^ k- t2[a])) 



when j4o is atomic 



Figure 4. Reification and reflection for call-by-value 



The equational theory CBN shift/reset, and just for the first level 
of the hierarchy, has been given by Kameyama and Tanaka |22]. 
In their paper, they distinguish two kinds of term applications, the 
usual one, and the one to continuation variables; and two kinds of 
substitutions, for normal variables, and for continuation variables. 
Please look at their paper for the definitions of those. The equa- 
tional theory is as follows: 



(\x.p)q 


^p{q/x} 


(10) 


(V) 


= V 


(11) 


k' ^ F[Sk.p] 


= {p{k ^ {k' ^ F)}) 


(12) 


Sk.(p) 


— Sk.p 


(13) 


Sk.k ■ p 


= p 


(14) 


{F[Sk.p]) 


= {p{k ^ F}) 


(15) 



We have used conventional syntax, writing reset ( — ) as ( ^ ) , and 
shift( — ) as Sk.p, and will continue to do so in the next subsection. 



3.2 Examples 

Let us now consider some test-runs of our TDPE in Coq, translated 
to conventional syntax here. After each example, we give the output 
using CBV TDPE and CBN TDPE. 

\xy.{Sk.y) (16) 
\xy.{y) (CBV) 
\xy.{{y)) (CBN) 

\x.{(\y.y){Sk.x)) (17) 
\x.{x) (CBV) 
\x.{{x)) (CBN) 

\x.{{{{^y.y)(Sk.x)))) (18) 
\x.{x) (CBV) 
\x.{{x)) (CBN) 

The simple examples so far respect the equational theory. There 
is a slight annoyance with the CBN normal forms: the resets are 
unnecessarily duplicated, but it has nothing to do with the number 
of reset as input, as can be seen from the third example. This 
duplication is due to a "bug" in the TDPE algorithm for CBN 
that we plan to correct in future. For now, let us just ignore the 
duplications (it does not contradict the equational thery, the rule|4j. 

Let us see the first divergence from the equational theory. 

\xy.{{xy)) (19) 
\xy.{xy) (CBV) 
\xy.{{x{y))) (CBN) 

Equation |4] does not allow to remove the extra reset in the CBV 
case. The TDPE algorithm in CBV could be adapted to produce 
more resets than needed, but there is no logical or computational 
justification to do that: normal forms will not reduce further, so the 
neater they are, the better. 

In the next example, the same conflict with CBV equations 
happens, but notice also the absence of further inside resets in the 
normal form. 

\xy.{x{Sk.k{ky))) (20) 
\xy.{x{xy)) (CBV) 
\xy.((x(y))) (CBN) 

The result in CBN is not a mistake. TDPE for CBN decided not 
to duplicate the applycation of x. I do not know how to derive it 
from the equational theory for CBN. However, when needed (when 
k is not applied to k itself), duplication can happen, as shown in the 
next example. 

Xxy.{x{x{Sk.k{ky)))) (21) 
\xy.{x{x{xy))) (CBV) 
\xy.{{x{x{y)))) (CBN) 

Let us now consider examples where two shifts are interacting 
inside the same reset, and see how the TDPE for CBV and for CBN 
give different results. The CBN normal form seems to be shorter in 



general. 

\xyz.{x{{y{Sk.k(kz))){Sk' .k' {k' z)))) (22) 

\xyz.{x{{y{{yz){yzz)my[{yz){yzz)))z)) (CBV) 

\xyz.{{x{{y{z)){z)))) (CBN) 



Xxyzu.{z{Sk.k{Sk'.k'{k'{k'u))))) (23) 

\xyzu.{z{z{zu))) (CBV) 

\xyzu.{{z{u))) (CBN) 

Finally, let us consider an example that involves the sum types. 

Xxy.{case x of {Xz.Sk.kz \\ Xz.z)} (24) 

Asy.case x of (Xz.{z) \\ Xz.{z)) (CBV) 

Aa;y.case x of {Xz.{{{z))) \\ Xz.{{{z)))) (CBN) 

Note that, not only is the reset pushed into the branches of the case- 
expression, but it also disappears in front of it. This is due to the 
fact that, in the reflection case for sum, the continuation calls are 
not tail calls - indeed, this is an essential part of the algorithm, and 
the reason one needs shift/reset for TDPE of lambda calculus with 
sums in the first place. 

4. Future and related work 

In future, I intend to explore a bit more the equational theories 
for the first level of the shift/reset hierarchy, and hopefully show 
the correctness of the TDPE algorithms with respect to some such 
theory. 

Besides the mentioned work l22ll directly developping equa- 
tions for CBN shift/reset, there are a number of other works ex- 
ploring CBN delimited control operators fTH,l23ll . that I intend to 
study in the future. 

I would also like to extend the method beyond the level- 1 of the 
shift/reset hierarchy. 

In this paper, we have limited ourselves to one atomic type for 
the reset, although a version for reset at a non-function type exists 
implemented in Coq. We have prefered to give this version, because 
it has a clearer and simpler characterization of normal forms. 
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